import frida

device = frida.get_device_manager().get_usb_device()


def on_spawned(spawn):
    print('on_spawned:', spawn)
    # 附加子进程的pid
    session1 = device.attach(spawn.pid)
    # 编写脚本hook
    script1 = session1.create_script("""
    var libcheck_addr =  Module.findBaseAddress("libcheck.so");
    console.log("libcheck_addr",libcheck_addr)
    // 对代码解密函数进行hook，thumb模式需要+1
    Interceptor.attach(libcheck_addr.add(0x85e0+1),{
        onEnter:function(args){
            console.log("0x85e0 onEnter")
            // var buffer = Memory.readByteArray(libcheck_addr.add(0xF1B0), 623);
            // console.log(buffer)
        }
        ,
        onLeave:function(retval){
            console.log("0x85e0 onLeave",retval)
            var buffer = Memory.readByteArray(retval, 0x270);

            console.log(buffer)

        }
    })
""").load()
    # 唤醒子进程
    device.resume(spawn.pid)


# 添加创建子进程回调
device.on('child-added', on_spawned)

session = device.attach("LoopCrypto")
# 开启子进程控制模式
session.enable_child_gating()

# with open("./0083.js") as f:
#     # 创建一个新脚本
#     script = session.create_script(f.read())
#
# # 加载脚本
# script.load()

command = ""
while True:
    command = input("Enter `n` for leave: ")
    if command == "n":
        break
